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Plaintiffs file this Statement of Recent Decision to alert the Court to the recent Order by 
the Honorable Judge Fern Flanagan Saddler in the Superior Court of the District of Columbia, 
Denying Defendant Facebook, Inc.’s Opposed Motion to Dismiss, or in the Alternative, to Stay 
Proceedings in District of Columbia v. Facebook, No. 2018 CA 8715 B (D.C. Super. Ct. May 31, 
2019). This decision relates to the arguments made by Plaintiffs in their Opposition to Motion of 
Defendant Facebook Inc. to Dismiss Plaintiffs’ First Amended Consolidated Complaint, ECF 
No. 266 at pp. 12-17, 41-42. A copy of this decision is attached hereto as Exhibit A. 
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ATTESTATION PURSUANT TO CIVIL LOCAL RULE 5-l(i)(3) 

I, Lesley E. Weaver, attest that concurrence in the filing of this document has been 
obtained from the other signatory. I declare under penalty of perjury that the foregoing is true 
and correct. 

Executed this 5th day of June, 2019, at Oakland, California. 

/s/ Lesley E. Weaver 
Lesley E. Weaver 
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EXHIBIT A 
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SUPERIOR COURT OF THE DISTRICT OF COLUMBIA 
CIVIL DIVISION 


) 

) 

) Case number: 2018 CA 8715 B 

) 

) 

) Judge Fern Flanagan Saddler 

) 

.) 

ORDER DENYING DEFENDANT FACEBOOK. INC.’S OPPOSED 

MOTION TO DISMISS. OR IN THE ALTERNATIVE, TO STAY 

PROCEEDINGS 

This matter is before this Court based upon Defendant Facebook, Inc.’s Opposed Motion 
to Dismiss, or in the Alternative, to Stay Proceedings, filed on February 1, 2019; and Plaintiff 
District of Columbia’s opposition thereto, filed on February 15, 2019. The parties came before 
the Court for a motion hearing on March 22, 2019. 

This case presents the novel issue of personal jurisdiction in the realm of online social 
media and the distribution and maintenance of Facebook users’ personal data. The issue of 
specific personal jurisdiction within the District of Columbia is central to this Order. Based upon 
the arguments of counsel, the parties’ filings, and the entire record herein. Defendant Facebook, 
Inc.’s Motion to Dismiss, or in the Alternative, to Stay Proceedings, is hereby denied. 

BACKGROUND AND PLEADINGS 


On December 19, 2018, the District of Columbia Office of the Attorney General 
(hereinafter, “the D.C. OAG”) filed a Complaint against Facebook, Inc. (hereinafter, 
“Facebook”) alleging that Facebook failed to honor its promise to protect consumers’ personal 
data in violation of the District of Columbia Consumer Protection Procedures Act (hereinafter, 
“CPPA”), D.C. Code §§ 28-3901 to 28-3913. 


DISTRICT OF COLUMBIA, 
Plaintiff, 
vs. 

FACEBOOK, INC., 

Defendant. 
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The D.C. OAG alleges that Facebook collects and maintains a trove of consumers’ 
personal data, and data concerning consumers’ digital behavior both on and off of Facebook’s 
website. Facebook allegedly permits third party developers, including developers of applications 
and mobile device makers, to access this sensitive information in connection with offering 
mobile applications to Facebook users. The D.C. OAG alleges that Facebook users reasonably 
expect Facebook to take steps to maintain and protect their data, but Facebook fails to do so. 

The D.C. OAG cites the 2013-2015 example of Facebook permitting Cambridge 
University researcher Aleksander Kogan to use a third party application to harvest the personal 
data of approximately 70 million Facebook consumers in the United States and then sell the data 
to Cambridge Analytica, a political consulting firm. Although Mr. Kogan’s application was only 
installed by 852 Facebook consumers in the District of Columbia, the application allegedly 
collected the personal information of users’ Facebook “friends,” including more than 340,000 
District of Columbia residents who did not download the application. 

The D.C. OAG alleges that this particular sequence of events regarding Cambridge 
Analytica was caused by Facebook’s failure to effectively oversee and enforce their consumer 
protection policies. The D.C. OAG alleges that Facebook failed to review the terms of Mr. 
Kogan’s application, which would have alerted Facebook to the fact that Mr. Kogan planned to 
improperly sell consumers’ data. The D.C. OAG also alleges that Facebook should have taken 
reasonable steps to protect consumers’ privacy by ensuring that the data was accounted for and 
deleted from Cambridge Analytical databases. Finally, the D.C. OAG alleges that Facebook 
failed to alert the public, including District of Columbia residents, that millions of users’ data 
was sold to Cambridge Analytica. The D.C. OAG also alleges that Facebook has engaged in 
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similar schemes with other applications and companies, and that the Cambridge Analytica 
incident is not an isolated event. 

Both parties have noted that several news articles were published regarding Facebook’s 
alleged sale of consumers’ private data to Cambridge Analytica in March 2018. In the wake of 
the publication of said news articles, the following two legal actions took place: 

(1) More than thirty (30) consumer class actions were filed across the country and 
consolidated into a federal Multi-District Litigation (hereinafter, “MDL”) in the Northern 
District of California. 

(2) The Federal Trade Commission (hereinafter, “FTC”) launched an investigation to 
determine whether Facebook violated a 2012 Consent Order between the FTC and 
Facebook. 

The instant case concerns the D.C. OAG’s Consumer Protection and Procedures Act (CPPA) 
claims against Facebook. 

1. Defendant Facebook’s Motion to Dismiss 

Facebook moves to dismiss the instant proceedings on the following grounds: First, that 
the Court lacks personal jurisdiction over Facebook in the instant matter; and second, that the 
D.C. OAG’s CPPA claim cannot withstand scrutiny. Alternatively, Facebook argues that this 
Court should stay the instant case pending the resolution of the MDL proceeding, and the FTC 
investigation. 

a. Facebook Argues that It is Not Subject to the General or Specific Jurisdiction of 
the District of Columbia 

First, Defendant Facebook contends that it is not subject to general jurisdiction in the 
District of Columbia. Facebook argues that it is not “at home” in the District of Columbia and 
therefore cannot be subject to the District of Columbia’s general jurisdiction. Def.’s Mot. 6 
(citing Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 924 (2011)). 
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Facebook further argues that the United States Constitution’s Due Process Clause 
prohibits the exercise of specific personal jurisdiction over Facebook in the District of Columbia. 
Facebook contends that the only basis for specific personal jurisdiction articulated in the D.C. 
OAG’s Complaint is that Facebook “supplies] social networking services through the operation 
of its website, www.facebook.com . and accompanying mobile applications, to consumers in the 
District of Columbia.” Def.’s Mot. 7. Facebook argues that only two situations permit District of 
Columbia courts to exercise personal jurisdiction over “purely online activities,” and the D.C. 
OAG has failed to allege facts to support a finding of jurisdiction in either situation. Id. (citing 
Triple Up Ltd. v. Youku Tudou Inc., 235 F. Supp. 3d 15, 22 (D.D.C. 2017)). 

First, Facebook argues that there is no indication that its website “functions as 
[Facebook’s] storefront in the forum.” See Def.’s Mot. 7. Facebook argues that it does not buy or 
sell services to District of Columbia consumers through its website; does not schedule deliveries 
to District of Columbia residents; and does not transact any business with District of Columbia 
residents. Id. at 8. Second, Defendant argues that the Complaint does not (and cannot) allege that 
Facebook “aimed” “unabashedly malignant acts” specifically at the District of Columbia, or that 
the “brunt of [the purported] harm” was felt in the District of Columbia. See id. (citing GTE New 
Media Servs., Inc. v. BellSouth Corp., 199 F.3d 1343, 1349 (D.C. Cir. 2000)). 

Defendant further argues that other courts have concluded that they lack specific personal 
jurisdiction over Facebook in similar cases. See Def.’s Mot. 8-9 (citing Georgalis v. Facebook, 
Inc., 324 F. Supp. 3d 955 (N.D. Ohio 2018); Ralls v. Facebook, 221 F. Supp. 3d 1237, 1244 
(W.D. Wash. 2016) (holding that the court lacked jurisdiction as the plaintiff had not provided 
any evidence that Facebook “purposefully directed [its] activities towards Washington.”)). 
Defendant Facebook therefore contends that personal jurisdiction over Facebook may not exist 
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simply because a user avails himself of Facebook’s services in a jurisdiction other than 
Delaware, where Facebook is incorporated, or California, where Facebook has its principal place 
of business. See Def.’s Mot. 9 (quoting Ralls, 221 F. Supp. 3d at 1244). 

b. Facebook Argues that It is Not Subject to Specific Personal Jurisdiction in the 
District of Columbia Under the District of Columbia Long-Arm Statute, D.C. 
Code § 13-423 

Facebook also argues that it is not subject to specific personal jurisdiction in the District 
of Columbia under the District of Columbia Long-Arm Statute, D.C. Code § 13-423. Facebook 
contends that a finding of personal jurisdiction in the present context would violate the District 
of Columbia’s Long-Arm Statute because Facebook is not subject to personal jurisdiction under 
the Due Process Clause. Defendant Facebook further argues that the instant Complaint does not 
sufficiently allege any one of the seven requirements for the Long-Arm Statute to be satisfied, 
thereby barring jurisdiction in the District of Columbia. See D.C. Code § 13-423(a)( 1 )-(7) 1 . 

c. Facebook Argues that the D.C. OAG Fails to State a Claim Under the District of 
Columbia Consumer Protection Procedures Act (CPPA) 

Facebook argues that the D.C. OAG’s claims fail under the CPPA because no actions or 
omissions by Facebook could be interpreted as “misleading” by a reasonable consumer. Def.’s 
Mot. 12. Specifically, Facebook argues that the D.C. OAG’s allegations regarding 
“misrepresentations” and “misleading statements” in Facebook’s Statement of Rights and 


1 D.C. Code § 13-423(a)( 1 )-(7) states in pertinent part that: “[a] District of Columbia court may exercise 
personal jurisdiction over a person, who acts directly or by an agent, as to a claim for relief arising from 
the person’s - (1) transacting any business in the District of Columbia; (2) contracting to supply services 
in the District of Columbia; (3) causing tortious injury in the District of Columbia by an act or omission 
in the District of Columbia; (4) causing tortious injury in the District of Columbia by an act or omission 
outside the District of Columbia if he regularly does or solicits business, engages in any other persistent 
course of conduct, or derives substantial revenue from goods used or consumed, or services rendered, in 
the District of Columbia; (5) having an interest in, using, or possessing real property in the District of 
Columbia; (6) contracting to insure or act as surety for or on any person, property, or risk, contract, 
obligation, or agreement located, executed, or to be performed within the District of Columbia at the time 
of contracting, unless the parties otherwise provide in writing; or (7) marital or parent and child 
relationship in the District of Columbia...” 


5 



Case 3:18-md-02843-VC Document 286 Filed 06/05/19 Page 11 of 38 


Responsibilities and Data Use Policy did not mislead consumers in the District of Columbia to 
falsely believe that their personal data was protected. See id. 

Facebook first contends that it disclosed the practices that the D.C. OAG characterizes as 
“misleading” to consumers. Def.’s Mot. 13. Facebook argues that “every policy” contested by 
the D.C. OAG was disclosed to users in Facebook’s Statement of Rights and Responsibilities and 
Data Use Policy. Facebook further contends that the Statement of Rights and Responsibilities 
and Data Use Policy contain policies that all Facebook consumers must agree to before creating 
a Facebook account. Id. 

Second, Facebook argues that it had no legal duty to notify consumers of the Aleksander 
Kogan and Cambridge Analytica conduct that took place in 2015. Def.’s Mot. 16. Facebook 
contends that, even if there was a legal duty to disclose Cambridge Analytica’s conduct to 
Facebook’s users, this legal duty would be imposed by D.C. Code § 28-3852, 2 not the CPPA. See 
id. Facebook claims that D.C. Code § 28-3852 supersedes the CPPA because it is a “more 
specific statute” that governs disclosures to consumers following data breaches. Id. Facebook 
argues that D.C. Code § 28-3852 did not impose a duty on Facebook to disclose to consumers 
that their data was misused in 2015, as the data at issue did not meet the statutory definition of 
“personal information” and was not obtained pursuant to a breach of Facebook’s security 
systems. Id. at 17. Facebook further argues that a reasonably well-informed consumer in the 
District of Columbia would have been on notice of the 2015 events by way of news coverage, 
which negated the need for Facebook to disclose Cambridge Analytica and Aleksander Kogan’s 
illicit conduct to Facebook consumers. Id. 


2 D.C. Code § 28-3852 imposes upon “any person or entity” who conducts business in the District of 
Columbia a duty to provide prompt notice to individuals whose personal information has been 
compromised by a breach of the security system maintained by that person or entity. 
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d. Alternatively, Facebook Argues that the Instant Case Should be Stayed Pending 
the Resolution of the Multi-District Litigation Proceeding and/or the Federal 
Trade Commission Investigation 

Finally, Defendant argues that the Court should stay this matter pending resolution of the 
Multi-District Litigation (MDL) proceeding, and the Federal Trade Commission (FTC) 
investigation. Facebook first asserts that the MDL proceeding involves similar factual allegations 
regarding Facebook’s conduct and practices. Facebook argues that, because the MDL was filed 
first and has been pending before the Northern District of California for over a year, the federal 
case should take precedence over the instant case. See Def.’s Mot. 16-17 (citing Thomas v. 
Disabled Am. Veterans Ass’n, 930 A.2d 997, 1000-01 (D.C. 2007); Gilles v. Ware, 615 A.2d 
533, 536 (D.C. 1992); Doe v. Hills, 217 F. Supp. 3d 199, 207 (D.D.C. 2016)). Facebook further 
argues that proceeding with the instant case while the MDL is pending would be unduly 
burdensome and may result in inconsistent rulings. Def.’s Mot. 17. 

Facebook also argues that this case should be stayed pending the outcome of the FTC 
investigation. Similar to its position on the MDL, Facebook contends that this case should be 
stayed because of overlapping issues. Def.’s Mot. 19. Facebook argues that the FTC is in a better 
position to determine, and possibly resolve, the technical issues present in this case about 
Facebook’s responsibility to users regarding the use or dissemination of users’ data. See id. 
(citing POM Wonderful, LLC v. FTC, 111 F.3d 478,493 (D.C. Cir. 2015)). Facebook asserts that 
staying this case will prevent potentially inconsistent rulings and allow the FTC to freely 
implement new consumer data policies. Def.’s Mot. 19. Facebook contends that “[a]ny 
injunctive relief ordered in this case ‘would preempt the [FTC] from implementing what amount 
to policy decisions...and technical questions on’ Facebook’s consumer data policies.” Id. (citing 
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Allnet Communication Service, Inc. v. Nat 7 Exchange Carrier Ass ’n, 965 F.2d 1118, 1121 (D.C. 
Cir. 1992)). 

2. The District of Columbia’s Opposition to Defendant Facebook, Inc.’s 

Motion to Dismiss 

The D.C. OAG opposes Defendant Facebook’s Motion to Dismiss on grounds that the 
District of Columbia courts have personal jurisdiction over Facebook. The D.C. OAG argues that 
this is a government enforcement case, so the personal jurisdiction analysis must begin with the 
fact that the District of Columbia has a “manifest interest” in providing a forum for adjudicating 
violations of its own laws. See Pl.’s Opp. 5 (citing Burger King Corp. v. Rudzewicz, 471 U.S. 
462, 473 (1985)). The D.C. OAG asserts that the Court’s interest in providing a forum for 
adjudicating violations of its own laws is particularly strong in this case, as the D.C. OAG seeks 
to enforce the D.C. CPPA, which “establishes an enforceable right to truthful information from 
merchants about consumer goods and services that are or would be received in the District of 
Columbia.” See D.C. Code § 28-3901 (c). The D.C. OAG explains that the District of Columbia 
may exercise personal jurisdiction over Facebook under both the United States Constitution’s 
Due Process Clause and the District of Columbia’s Long-Arm Statute, D.C. Code § 13-423. 

a. The D.C. OAG Argues that Facebook is Subject to Personal Jurisdiction Under 
the United States Constitution’s Due Process Clause 

First, the D.C. OAG argues that Defendant Facebook is subject to personal jurisdiction in 
the District of Columbia under the United States Constitution’s Due Process clause. The D.C. 
OAG asserts that the District of Columbia Court of Appeals applies the “minimum contacts” 
analysis by examining whether: (1) the nonresident “purposefully directed” its activities at 
District of Columbia residents; (2) the litigation results from alleged injuries that “arise out of or 
relate to” those activities; and (3) the assertion of personal jurisdiction comports with “traditional 
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notions of fair play and substantial justice.” See Pl.’s Opp. 5-6 (citing Shoppers Food Warehouse 
v. Moreno , 746 A.2d 320, 330-31, 34 (D.C. 2000)). The D.C. OAG argues that Facebook 
satisfies the “minimum contacts” requirements through its activities in the District of Columbia. 

The D.C. OAG first argues that Facebook purposefully directed its activities to the 
District of Columbia by directing its social networking services to District of Columbia 
consumers. The D.C. OAG argues that Facebook purposefully directed its activities to the 
District of Columbia, as evidenced by: (1) Facebook’s regulatory filings with the District of 
Columbia Department of Consumer and Regulatory Affairs (hereinafter, “DCRA”); (2) case law 
from similar state government enforcement cases; and (3) federal precedent examining online 
businesses like Facebook that operate on a national scale. See Pl.’s Opp. 6. The D.C. OAG 
asserts that it does not matter that Facebook “operates in the same manner in all jurisdictions,” as 
it is more than sufficient that Facebook made misleading representations to hundreds of 
thousands of consumers in the District of Columbia, signed them up for its social networking 
services, and then exploited their data for commercial gain through the sale of targeted 
advertisements. See id.', Compl. 1, 14, 17, 72-76. The OAG argues that Facebook operates and 
monetizes a sophisticated social networking service used by nearly half of all District of 
Columbia residents, and estimates that Facebook earned more than $10 million in the fourth 
quarter of 2018 from selling targeted advertising in the District of Columbia. See Pl.’s Ex. 1; 
Shirey Aff. tl 3-4. 

The D.C. OAG further argues that the instant action satisfies the Due Process Clause’s 
“minimum contacts” requirement because it arises out of Facebook’s representations to District 
of Columbia consumers. See Pl.’s Opp. 10 (citing Shoppers Food Warehouse, 74 A.2d at 328). 
The D.C. OAG asserts that the District of Columbia Court of Appeals has interpreted the “nexus 
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requirement” in the minimum contacts analysis to require only a “discernible relationship” 
between the cause of action and the forum activities. See id. (citing Shoppers Food Warehouse , 
74 A.2d at 335). The D.C. OAG argues that, in the instant case, the nexus between the cause of 
action and the forum activities satisfies this requirement, as the D.C. OAG’s claims arise directly 
out of Facebook’s forum activities, namely, Facebook’s representations and services provided to 
District of Columbia consumers. See id. The D.C. OAG concludes that exercising jurisdiction 
over Facebook would be fair based upon the representations Facebook consistently makes to its 
extensive network of District of Columbia consumers in a jurisdiction where it regularly 
transacts business. See id. 

b. The D.C. OAG Argues that Facebook is Subject to Personal Jurisdiction Under 
the District of Columbia Long-Arm Statute, D.C. Code. § 13-423 

In addition to arguing that Defendant Facebook is subject to personal jurisdiction in the 
District of Columbia under the Due Process Clause, the D.C. OAG also argues that Facebook is 
subject to personal jurisdiction under the District of Columbia Long-Arm Statute, D.C. Code. § 
13-423. The D.C. OAG first notes that the District of Columbia Long-Arm Statute, D.C. Code § 
13-423(a)(1) is “coextensive” with the Due Process Clause, and thus the Long-Arm Statute 
analysis is included within the Due Process Clause inquiry. See Pl.’s Opp. 12. 

Further, the D.C. OAG notes that Facebook admitted to providing its social networking 
services in the District of Columbia, and it counts hundreds of thousands of District of Columbia 
consumers among its users. See id. The D.C. OAG asserts that Facebook’s argument that “[it] 
does not conduct business in the District of Columbia” because Facebook’s social networking 
services are provided “free for all users worldwide” is factually and legally incorrect. Id. The 
D.C. OAG contends that Facebook fails to address the D.C. OAG’s allegations that Facebook’s 
networking services are part-and-parcel of a business model that monetizes consumer data 
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“through the sale of targeted advertising.” See id. Moreover, the D.C. OAG argues that neither 
the CPPA nor jurisdictional case law require a monetary exchange to find that a defendant 
“transacts] any business” in the District of Columbia. See id. 12-13. 

Moreover, the D.C. OAG argues that Facebook is subject to personal jurisdiction under 
D.C. Code § 13-423(a)(3), which authorizes personal jurisdiction over a defendant “who caus[es] 
tortious injury in the District of Columbia by an act or omission in the District of Columbia.” 
Pl.’s Opp. 13. The D.C. OAG argues that the alleged injuries were plainly suffered in the District 
of Columbia, which is also the residence of Facebook’s District of Columbia consumers. See id. 
The D.C. OAG also argues that Facebook’s CPPA violations occurred in the District of 
Columbia because “it is there that [District of Columbia] consumers accessed Facebook’s 
services.” Id. Additionally, the D.C. OAG contends that Facebook’s documents confirm that 
Facebook employees based in the District of Columbia were involved in the response and 
oversight of the Cambridge Analytica incident, further establishing that Facebook’s relevant acts 
and omissions took place in the District of Columbia. Id. 

Furthermore, the D.C. OAG argues that D.C. Code § 13-423(a)(4) authorizes jurisdiction 
over Facebook. See Pl.’s Opp. 13. D.C. Code § 13-423(a)(4) provides that a defendant may be 
subject to personal jurisdiction in the District of Columbia if the defendant causes tortious injury 
in the District of Columbia by acts or omissions “outside” the jurisdiction when the defendant 
“regularly does or solicits business...or derives substantial revenue from services rendered” in 
the District of Columbia. See Pl.’s Opp. 13-14. The D.C. OAG contends that Facebook’s 
corporate filings, Facebook’s consumers in the District of Columbia, and the estimated $10 
million in District of Columbia advertising revenue from a single fiscal quarter demonstrate that 
Facebook engages in regular business transactions in the District of Columbia. See id. 
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Finally, the D.C. OAG contends that Facebook “marginalizes” its District of Columbia 
consumer base by arguing that “[District of Columbia consumers] cannot possibly be a source of 
‘substantial revenue’ because they constitute ‘a mere .01 percent’ of [Facebook’s] global user 
base.” Pl.’s Opp. 14. The D.C. OAG argues that a “substantial revenue” determination involves 
examining both the “absolute amount” and the “percentage of total sales,” and that a small 
percentage of total sales can constitute substantial revenue when the absolute amount is “well 
into the millions.” See id. Accordingly, the D.C. OAG argues that the District of Columbia Long- 
Arm Statute authorizes jurisdiction over Facebook in several ways. See id. 

c. The D.C. OAG Argues that It Successfully States a Claim Under the District of 
Columbia Consumer Protection and Procedures Act (CPPA) 

In addition to arguing that Facebook is subject to jurisdiction in the District of Columbia, 
the D.C. OAG contends that it successfully states a claim under the CPPA. The D.C. OAG first 
argues that Facebook’s disclosures to its consumers were inconsistent, inaccurate, and 
ambiguous. Pl.’s Opp. 14. While the D.C. OAG alleges that these disclosures were both material 
and “had a tendency to mislead consumers,” the D.C. OAG also argues that materiality and 
“tendency to mislead” are questions of fact that cannot be resolved at this stage of litigation. Id. 

Furthermore, the D.C. OAG asserts that Facebook misled consumers by claiming that 
Facebook “is not responsible for how third parties used consumers’ personal data,” as this 
statement directly conflicted with Facebook’s promise to ensure that third parties respected 
consumers’ privacy. Pl.’s Opp. 15. The D.C. OAG further argues that Facebook failed to hold 
third parties accountable to the privacy policies Facebook advertised to its consumers. See id. at 
15-17. 
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d. The D.C. OAG Argues that the Instant Matter Should Not be Stayed Pending 
the Resolution of the Multi-District Litigation Proceeding and/or the Federal 
Trade Commission Investigation 

The D.C. OAG argues that Facebook has failed to establish that a stay of the proceedings 
is warranted in this case, as Facebook has not “ma[de] out a clear case of hardship” if the stay 
were to be denied. See Pl.’s Opp. 19 (citing Landis v. N. Am. Co., 57 S. Ct. 163,255 (1936)). The 
D.C. OAG argues that this case is distinguishable from the MDL because, in the instant case, the 
D.C. OAG is pursuing a state consumer protection claim on behalf of the residents of the District 
of Columbia, while the MDL involves claims asserted by private individuals. See Pl.’s Opp. 19. 
The D.C. OAG further argues that the MDL Court has already decided a similar issue regarding 
jurisdiction over consumer protection claims filed by the Cook County, Illinois State Attorney’s 
Office, which resulted in the case being remanded back to Cook County because the court 
determined that the case was properly heard in state court. See id. (citing In re Facebook, Inc. 
Consumer Privacy User Profile Litig., 2019 WL 348892, at *2 (N.D. Cal. Jan. 29,2019)). 

Moreover, the D.C. OAG argues that the FTC investigation is wholly distinct from the 
claims brought by the D.C. OAG under the CPPA. See Pl.’s Opp. 20. The D.C. OAG contends 
that the FTC investigation seeks to determine whether Facebook’s conduct violates a 2012 
Consent Order entered into by the FTC and Facebook, an issue which has no bearing on the D.C. 
OAG’s claims. See id. The D.C. OAG argues that, even if the FTC investigation and this case 
presented overlapping issues, it would be imprudent to stay this proceeding. See id. 

THE COURT’S RULING 

1. Facebook is Subject to Personal Jurisdiction in the District of Columbia 

Defendant Facebook is incorporated in Delaware, and thus is a foreign corporation. 
Therefore, jurisdiction over Facebook depends upon the application of the Due Process Clause of 
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the United States Constitution and the District of Columbia’s Long-Arm Statute, D.C. Code § 
13-423(a). See Daley v. Alpha Kappa Alpha Sorority, Inc., 26 A.3d 723, 727 (D.C. 2011). The 
Due Process Clause analysis requires the Court to analyze a defendant’s ties to the venue under 
both general personal jurisdiction and specific personal jurisdiction. See Daimler AG v. Bauman, 
571 U.S. 117, 137-39 (2014). This Court finds that Defendant Facebook is not subject to general 
personal jurisdiction in the District of Columbia. However, Facebook js subject to specific 
personal jurisdiction under the Due Process Clause and the District of Columbia’s Long-Arm 
Statute, D.C. Code § 13-423(a). The Court’s findings are explained below. 

a. The District of Columbia Lacks General Personal Jurisdiction Over Facebook 

The Court first finds that Facebook is not subject to general personal jurisdiction in the 

District of Columbia. A court may assert general personal jurisdiction over a defendant 
corporation if the corporation is either incorporated or has its principal place of business in the 
court’s jurisdiction. See Daimler AG, 571 U.S. at 138-39 (citing Goodyear Dunlop Tires 
Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). 

In this case, Defendant Facebook is a Delaware corporation with its headquarters and 
principal place of business in California. Compl. 9. Accordingly, as Facebook is neither 
incorporated in, nor has its principal place of business in the District of Columbia, this Court 
lacks general personal jurisdiction over Defendant Facebook. 

b. Facebook is Subject to Specific Personal Jurisdiction in the District of 
Columbia 

The Court finds that it does have specific personal jurisdiction over Facebook. When a 
forum seeks specific personal jurisdiction over an out-of-state defendant, the Due Process 
Clause’s “fair warning” requirement is satisfied if the defendant has “purposefully directed” its 
activities to the forum and the lawsuit results from alleged injuries that “arise out of or relate to” 
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those activities. Burger King Corp., 471 U.S. at 472-73 (internal citations omitted). In other 
words, there must be “minimum contacts” between the defendant and the forum state before 
specific personal jurisdiction can be exercised consistently with the Due Process Clause. See 
International Shoe Co. v. Washington, 326 U.S. 310, 316 (1945). Once a court has determined 
that a defendant has purposefully established minimum contacts within the forum state, these 
contacts should be considered in light of other factors to determine whether the assertion of 
specific personal jurisdiction would comport with “fair play and substantial justice.” Burger 
King Corp., 471 U.S. at 476 (citing International Shoe Co., 326 U.S. at 320). 

The District of Columbia Court of Appeals’s minimum contacts analysis requires the 
Court to examine the quality and nature of the nonresident defendant’s contacts with the District 
of Columbia and whether those contacts are voluntary and deliberate or only random, fortuitous, 
tenuous, and accidental. See Daley, 26 A.3d at 727-28 (citing Shoppers Food Warehouse, 746 
A.2d at 329). In other words, “minimum contacts” in the District of Columbia are established if 
the Court finds that the non-resident defendant’s conduct and connection with the jurisdiction are 
such that the defendant “should reasonably anticipate being haled [sic] into court [here].” See 
Daley, 26 A.3d at 727 (quoting Gonzalez v. Internacional de Elevadores, S.A., 891 A.2d 221, 
234 (D.C. 2006)). The D.C. OAG must therefore establish that Facebook has sufficient 
“minimum contacts” in this jurisdiction by demonstrating that Facebook purposefully directed its 
activities at District of Columbia residents. See Gonzalez, 891 A.2d at 234. 

The relationship between a defendant’s online activity and its susceptibility to suit in a 
foreign jurisdiction remains ill-defined, and the United States Supreme Court has yet to offer 
guidance in this particular area. See Triple Up Ltd. v. Youku Tudou Inc., 235 F. Supp. 3d 15, 23 
(D.D.C. 2017), ajf’d, 2018 U.S. App. LEXIS 19699 at *5-7 (D.C. Cir. 2018). However, it is clear 
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that “mere accessibility” of the defendant’s website in the forum cannot by itself establish the 
necessary minimum contacts. Triple Up Ltd., 235 F. Supp. 3d at 23 (citing GTE New Media 
Servs. v. BellSouth Corp., 199 F.3d 1343, 1350 (D.C. Cir. 2000). District of Columbia residents’ 
access to a defendant’s website is therefore not enough to establish personal jurisdiction, as this 
does not by itself show any persistent course of conduct by the defendant in the forum. See 
Triple Up, Ltd., 2018 U.S. App. LEXIS 19699 at *6. 

However, the Court’s analysis does not end there. In the context of Internet-based 
corporations, federal courts in the District of Columbia commonly find Internet-based personal 
jurisdiction in at least two situations. See Triple Up Ltd., 235 F. Supp. 3d at 24. First, personal 
jurisdiction may exist where “residents use a website to engage in electronic transactions with 
the defendant”—that is, where the website functions as the defendant’s storefront in the forum. 
Id. at 24 (citing Gorman v. Ameritrade, 293 F.3d 506, 512-13 (D.C. Cir. 2002) (finding that 
defendant’s website was “conducting business” in this jurisdiction through its everyday online 
transactions with District of Columbia residents)). Second, jurisdiction may attach under the 
“effects test” articulated in Colder v. Jones, 465 U.S. 783 (1984), which looks to whether “the 
defendant’s conduct is aimed at or has an effect in the forum state.” Triple Up, 235 F. Supp. 3d 
at 24 (citing GTE New Media Servs., 199 F.3d at 1349). 

i. Facebook’s Online Accessibility and “Transactions” Satisfy the District of 
Columbia’s Minimum Contacts Analysis 

The Court finds that Facebook’s accessibility and transactions with District of Columbia 
residents, coupled with Facebook’s repeated DCRA filings and business dealings in the District 
of Columbia, satisfy the required minimum contacts necessary to establish personal jurisdiction. 
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A. Facebook’s Website Qualifies as a “Storefront” in the District of 

Columbia 

The Court first finds that Facebook’s website functions as the its “storefront” in the 
District of Columbia, as Facebook transacts continuous and systematic business with District of 
Columbia residents through its online platform. See Gorman v. Ameritrade Holding Corp., 293 
F.3d 506, 512 (D.C. Cir. 2002) (citing Zippo Mfg. Co. v. Zippo Dot Com, Inc., 952 F. Supp. 
1119, 1124 (W.D. Pa. 1997)). In order to establish minimum contacts in the District of 
Columbia, the website must be used by a defendant to do business with residents in the 
forum state in a “continuous and systematic way.” See Atlantigas Corp. v. Nisource, Inc., 290 F. 
Supp. 2d 34, 51 (D.D.C. 2003). The question is not whether District of Columbia residents “can” 
transact business in the District of Columbia with a non-resident defendant through its website, 
but whether non-resident defendants actually “do” engage in sustained business activities in a 
continuous and systematic way. Id. at 52 (citing Gorman, 293 F.3d at 512-13). 

This Court finds that District of Columbia residents’ widespread utilization of, and 
repeated exchange of personal information through Facebook’s online social networking service, 
constitute “transactions” for purposes of establishing personal jurisdiction in the District of 
Columbia. In reaching this conclusion, the Court compares Facebook with other websites that 
have been found to “transact business” with District of Columbia residents. 

The United States Court of Appeals for the District of Columbia Circuit previously found 
that the website Ameritrade was “transacting business” with District of Columbia residents 
through online brokerage accounts. See Gorman, 293 F.3d at 512-13. Ameritrade’s website 
allowed for District of Columbia users to transmit funds, use the online accounts to buy and sell 
securities, and to enter binding contracts with Ameritrade online twenty-four hours a day. See id. 
The D.C. Circuit found that Ameritrade’s consistent, around-the-clock transactions allowed for 
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the website to have “continuous and systematic” contacts with the District of Columbia, thereby 
suggesting that Ameritrade was “conducting business” in the District of Columbia for purposes 
of establishing personal jurisdiction. See id. (citing Zippo Mfg. Co., 952 F. Supp. at 1124). 

In contrast to Gorman, the D.C. Circuit recently found that a Chinese video-hosting 
website, Youku, 3 was not “transacting business” in the District of Columbia because it could not 
establish that any United States viewers had purchased or otherwise engaged in business 
transactions on the Youku website. See Triple Up Ltd., 235 F. Supp. 3d at 24, aff’d, 2018 U.S. 
App. LEXIS 19699 at *5-8. Furthermore, the D.C. Circuit noted that there was no plausible 
allegation suggesting that Youku designed its website to purposefully target users in the United 
States. 4 See Triple Up Ltd., 2018 U.S. App. LEXIS 19699 at *6. 

The instant case concerns Defendant Facebook’s free social media service that is distinct 
from Youku or Ameritrade, as Facebook does not utilize a traditional form of merchant- 
consumer transactions. Facebook is an American website that is widely used and accessed all 
over the globe through individual computers, mobile telephones, and other electronic devices. 
See Compl. 10. To begin using Facebook, a consumer creates a Facebook account, which 
requires users to provide basic personal information such as their name, telephone number, email 
address, date of birth, and gender. See id. ^ 11, 13. A Facebook profile costs nothing to create 
and maintain. See id. ^ 17. Facebook users can add other users as “friends,” and build a social 
network on the website by accumulating Facebook “friends.” Id.\ 11. Facebook users also have 
the option to supply additional information through their Facebook profile such as their 

3 

Youku is incorporated in the Cayman Islands and its principal place of business is in China. Youku has no offices 
or employees in the United States, and it does not market its products or services here. See Triple Up Ltd ,, 235 F. 
Supp. 3d at 19. However, Youku stock has been traded in the New York Stock Exchange, and it has maintained an 
agent for service of process in New York. Id. 

4 Youku operates two website platforms on which users can view and publish high-quality videos, and an online 
search engine where users can search for and view online videos. See Triple Up Ltd., 2018 U.S. App. LEXIS 19699 
at *18. Youku generates revenue from online advertising services and subscription or pay-per-view online services. 
See id. at *19. 
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hometown, residence, educational history, work experience, relationship status, political and 
religious views, and personal photographs. Id. ^ 13. It is through users’ accumulation of 
Facebook “friends” and sharing of personal data that social media “networks” are developed on 
the Facebook platform. Id. ^ 11. 

As Facebook consumers share information, grow their social networks, and interact with 
other “friends” on the Facebook website, users’ information and activity is digitally collected, 
recorded, and maintained by Facebook. Id. 12. The D.C. OAG asserts that Facebook users’ 
data can be divided into two broad categories: (1) data directly supplied by consumers, and (2) 
data pertaining to consumers’ activity on and offFacebook’s website. Id. The D.C. OAG alleges 
that Facebook then relies on its collection of consumer data, and the personal information and 
preferences derived from each individual’s data, to sell targeted advertising space to marketers 
and to “harvest” users’ personal data for third parties. See id. 1,17. 

In addition to Facebook’s online activities, Facebook has physically conducted business 
within the District of Columbia. First, Facebook made repeated filings with the District of 
Columbia Department of Consumer and Regulatory Affairs (hereinafter, “DCRA”), and 
registered as a foreign corporation in the District of Columbia in 2009. See Pl.’s Opp. 6; Pl.’s Ex. 
2. Additionally, Facebook purportedly operates an office with over 150 employees within the 
District of Columbia. See Pl.’s Opp. 13. Finally, it is alleged that Facebook acquired an estimated 
$10 million in revenue from its District of Columbia users in the fourth quarter of 2018 alone, 
thereby suggesting that Facebook has consistently acquired substantial revenue from its 
consumers within the District of Columbia. See id. at 14; Pl.’s Ex. 1; Shirey Aff. ^ 3-4. 

This Court concludes that the substantial revenue Facebook has allegedly derived from its 
activities in the District of Columbia area, coupled with Facebook’s repeated DCRA filings and 
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operations within the District of Columbia, qualify Facebook’s online social networking services 
as “business transactions” for purposes of establishing specific personal jurisdiction. The Court 
first notes that Facebook provides a free online service to its users, and that “services” may 
qualify as business “transactions” for purposes of the CPPA. See D.C. Code § 13-423(a)(2). 
Facebook’s “transactions” involve Facebook users freely sharing their personal data with other 
users, which Facebook then allegedly collects and sells to third parties. See Compl. 13-17. 

As previously noted, over 340,000 District of Columbia residents’ Facebook data was 
allegedly acquired by Cambridge Analytica between 2013-2015, and Facebook allegedly accrued 
an estimated $10 million in revenue from District of Columbia residents’ data in the fourth 
quarter of 2018. See id. ^ 2, 30; Pl.’s Opp. 14. These records showcase Facebook’s practice of 
redistributing and selling users’ personal data for significant profit, which forms the basis of 
Facebook’s online business and revenue. This Court finds that Facebook’s distribution of District 
of Columbia users’ personal data for profit therefore qualifies as systematic and continuous 
“transactions” between Facebook and its consumers in the District of Columbia. 

Additionally, this Court finds Facebook’s operations and filings with the District of 
Columbia DCRA demonstrate that Facebook consistently transacts business in the District of 
Columbia. In its Application for Certificate of Authority for Foreign Business & Professional 
Corporation, filed on April 24, 2009, Facebook stated that it would transact business in the 
District of Columbia in the form of “ONLINE SOCIAL NETWORKING.” See Pl.’s Ex. 2 
(emphasis in original). Facebook made similar statements in its DCRA filings in 2011, 2014, 
2016, and 2018. See id. Moreover, Facebook purportedly maintains a large corporate presence 
within the District of Columbia. See Pl.’s Opp. 11. Accordingly, this Court finds that Facebook’s 
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Facebook’s website qualifies as an online “storefront” in the District of Columbia for purposes of 
establishing minimum contacts. 

B. Facebook’s Conduct Had an Effect in the District of Columbia 
Further, this Court finds that Facebook’s conduct “had an effect” in the District of 
Columbia, thereby subjecting Facebook to personal jurisdiction. See Triple Up Ltd., 235 F. Supp. 
3d at 23. Although Facebook “operates in the same manner in all jurisdictions,” Facebook 
purposefully directed its social networking services to the District of Columbia as evidenced by 
its multiple filings with the DCRA. See Pl.’s Opp. 6; Pl.’s Ex. 2. Specifically, Facebook filed an 
Application for Certificate of Authority for Foreign Business & Professional Corporation with 
the DCRA in 2009, and consistently filed Two-Year Reports for Foreign Business in 2011,2014, 
2016, and 2018. See Pl.’s Ex. 2. Facebook’s obligation to keep the District of Columbia apprised 
of its business activities within the District of Columbia strongly suggests that Facebook had an 
eye towards attracting District of Columbia users. Moreover, Facebook’s practices clearly had an 
“effect” in this jurisdiction when over 340,000 District of Columbia residents’ personal data was 
collected by Cambridge Analytica from 2013-2015. See Compl. U 2-3, 30; Pl.’s Opp. 9. At this 
stage of litigation, this Court finds that Facebook’s conduct has had an effect in the District of 
Columbia, thereby permitting specific personal jurisdiction under the Due Process Clause. 

c. Facebook Is Subject to Personal Jurisdiction in the District of Columbia Under 
the District of Columbia Long-Arm Statute, D.C. Code § 13-423 

In addition to finding that Defendant Facebook is subject to specific personal jurisdiction 

under the Due Process Clause of the United States Constitution, the Court also finds that 

Defendant Facebook is subject to personal jurisdiction under the District of Columbia Long-Arm 

Statute, D.C. Code § 13-423. 
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If a defendant does not reside within or maintain a principal place of business in the 
District of Columbia, then the District of Columbia’s Long-Arm Statute, D.C. Code § 13-423, 
provides the only basis upon which a court may exercise personal jurisdiction over the 
defendant. Quality Air Servs., LLC v. Milwaukee Valve Co., 567 F. Supp. 2d 96, 99 (D.D.C. 
2008) (internal citations omitted). The Long-Arm Statute provides, inter alia, that a District of 
Columbia court may exercise personal jurisdiction over a defendant as to a claim for relief 
arising from the defendant: (1) transacting any business in the District of Columbia; (2) 
contracting to supply services in the District of Columbia; (3) causing tortious injury in the 
District of Columbia by an act or omission in the District of Columbia; and/or (4) causing 
tortious injury in the District of Columbia by an act or omission outside the District of Columbia, 
if the defendant regularly does or solicits business, engages in any other persistent course of 
conduct, or derives substantial revenue from goods used or consumed, or services rendered, in 
the District of Columbia. See D.C. Code § 13-423(a)(l)-(4). 

The Court finds that all four relevant prongs are met in this context. First, D.C. Code § 
13-423 (a)(1) is satisfied because Facebook “transacted business” in the District of Columbia by 
acquiring revenue from its District of Columbia users’ data. Additionally, Facebook’s repeated 
filings with the DCRA indicate that Facebook intended to conduct business in the District of 
Columbia from 2007 through the present. See id. ^ 14. The Court therefore finds that Facebook 
“transacted business” in the District of Columbia for purposes of satisfying section (a)(1) of the 
Long-Arm Statute. 

Furthermore, the Court finds that D.C. Code § 13-423(a)(2) is satisfied because Facebook 
contracted to supply services in the District of Columbia. As noted previously, Facebook 
provides a free social media services to its users around the world, including to District of 
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Columbia residents. Facebook’s users effectively enter into a contract with Facebook when they 
create a Facebook profile, agree to Facebook’s Terms of Service, and in return receive access to 
Facebook’s social media service. See Compl. If 44-48. Accordingly, jurisdiction under D.C. Code 
§13-423(a)(2) is also authorized. 

The Court also finds that D.C. Code § 13-423(a)(3) is satisfied because Facebook’s 
alleged tortious conduct occurred within the District of Columbia. The D.C. OAG alleges that 
Facebook misrepresented how it would collect and maintain its users’ data in its Terms of 
Service and Privacy Policy, which are available and accessible by Facebook users in the District 
of Columbia. Facebook’s alleged misrepresentations in its Statement of Rights and 
Responsibilities and Data Use Policy misled District of Columbia Facebook users to believe that 
their personal data was secure and protected from illicit distribution. Accordingly, this Court 
finds that Facebook’s alleged tortious conduct was committed in the District of Columbia when 
Facebook allegedly misled District of Columbia residents through its Statement of Rights and 
Responsibilities and Data Use Policy, thereby satisfying section (a)(3) of the District of 
Columbia Long-Arm Statute. 

Finally, the Court finds that D.C. Code § 13-423(a)(4) is satisfied. The District of 
Columbia Court of Appeals has held that the Long-Arm Statute’s “transacting business” 
provision, D.C. Code § 13-423(a)(4), is coextensive with the Due Process Clause. See Daley v. 
Alpha Kappa Alpha Sorority, Inc., 26 A.3d 723, 727 (D.C. 2011). District of Columbia Code § 
13-423(a)(4) therefore applies if personal jurisdiction under the Due Process Clause has been 
established, as it has in this case. As stated previously, Facebook’s social media platform allows 
for Facebook and District of Columbia residents to “engage in a persistent course of conduct.” 
Moreover, Facebook derives substantial revenue from its services rendered in the District of 
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Columbia, as demonstrated by the purported $10 million in revenue Facebook accrued from its 
District of Columbia users in the fourth quarter of 2018. Based upon the available evidence, this 
Court finds that Facebook’s regular business transactions, combined with the social media 
services it provides to District of Columbia residents on a continuous basis, subject Facebook to 
personal jurisdiction under both D.C. Code § 13-423(a)(4) and the Due Process Clause. 

2. The D.C. OAG’s CPPA Claims Satisfy the Civil Procedure Rule 8(a) 

Pleading Standard 

In addition to finding that Facebook is subject to jurisdiction in the District of Columbia, 
this Court finds that the allegations in the D.C. OAG’s Complaint are sufficient to satisfy Rule 
8(a) of the Superior Court Rules of Civil Procedure. A complaint should be dismissed under Rule 
12(b)(6) if it fails to satisfy the pleading standard outlined in Rule 8(a). Specifically, a complaint 
should be dismissed if it fails to contain a “short and plain statement of the claim showing that 
the pleader is entitled to relief.” See Potomac Devel. Corp. v. District of Columbia, 28 A.3d 531, 
544 (D.C. 2011). When evaluating a party’s motion to dismiss, the Court must construe the 
pleadings in the light most favorable to the party not seeking dismissal—in this case, the D.C. 
OAG. Atraqchi v. GUMC Unified Billing Servs., 788 A.2d 559, 562 (D.C. 2002). 

While Rule 8(a) does not require “detailed factual allegations,” it does require more than 
a mere “unadorned the-defendant-unlawfully-harmed-me accusation.” See Atraqchi, 788 A.2d at 
562 (citations omitted). Essentially, “a complaint must set forth sufficient information to outline 
the legal elements of a viable claim for relief or to permit inferences to be drawn from the 
complaint that indicate that these elements exist.” Williams v. District of Columbia, 9 A.3d 484, 
488 (D.C. 2010). 

The entirety of the Court’s findings with respect to Facebook’s Rule 12(b)(6) Motion 
should be read with the applicable legal standard in mind, namely, that the D.C. OAG’s 
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allegations must be sufficient to satisfy the Rule 8(a) pleading standard. Accordingly, the Court 
must address the adequacy of the D.C. OAG’s CPPA claims under Rule 8(a). 

District of Columbia courts have consistently recognized that the CPPA is “a 
comprehensive statute designed to provide procedures and remedies for a broad spectrum of 
practices which injure consumers.” Snowder v. District of Columbia , 949 A.2d 590 (D.C. 2008) 
(internal citations omitted). In the instant case, the D.C. OAG brings CPPA claims under D.C. 
Code §§ 28-3904 (e), (f), and (f-1). The Court must therefore determine whether the D.C. OAG’s 
complaint satisfies the Rule 8(a) pleading standard with respect to its claims under D.C. Code §§ 
28-3904 (e), (f), and (f-1). 

Sections (e), (f), and (f-1) of the CPPA provide: 

It shall be a violation of this chapter for any person to engage in an unfair or deceptive 
trade practice, whether or not any consumer is in fact misled, deceived, or damaged 
thereby, including to 

(e) misrepresent as to a material fact which has a tendency to mislead; 

(f) fail to state a material fact if such failure tends to mislead; 

(f-1) [u]se innuendo or ambiguity as to a material fact, which has a tendency to 

mislead[.] D.C. Code §§ 28-3904 (e)-(f-l). 

When the CPPA is utilized to remedy unfair trade practices, the Court should consider the 
allegedly deceptive practices “in terms of how [the practices] would be viewed and understood 
by a reasonable consumer.” See Pearson v. Chung, 961 A.2d 1067, 1075 (D.C. 2008). As a 
general rule, accurate statements are not misleading to reasonable consumers. Saucier v. 
Countrywide Home Loans, 64 A.3d 428, 444 (D.C. 2013). However, what a “reasonable 
consumer” would consider material or misleading is generally a question for the jury, and cannot 
necessarily be resolved at the motion to dismiss stage of litigation. Id. at 442, 444-45. Instead, 
the Court must determine whether the allegations, taken as true, could be reasonably interpreted 
by a consumer as misleading, and if so, the pleading standard set forth in Rule 8(a) is satisfied. 
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District of Columbia courts have also held that misleading statements may constitute 

violations of D.C. Code §§ 28-3904(e), (f), and (f-1), even if the statement is technically 

accurate, because a reasonable consumer could still be misled by technically accurate 

information. National Consumer’s League v. Doctor’s Assocs., 2014 D.C. Super. LEXIS 15 

(D.C. Super. Ct. Sept. 12, 2014); see also Federal Trade Commission v. Brown & Williamson 

Tobacco Corp., 778 F.2d 35, 41-42 (D.C. Cir. 1985). 

Pursuant to the above legal standard, the Court’s Rule 12(b)(6) analysis concerning the 

D.C. OAG’s CPPA claims must focus on whether the D.C. OAG alleges sufficient facts to 

demonstrate that Facebook’s alleged statements, actions, or omissions could be interpreted by a 

reasonable consumer as material and misleading. This determination is made irrespective of 

whether the information provided to consumers was “technically accurate.” In sum, the Court’s 

Rule 12(b)(6) inquiry must determine whether D.C. OAG’s allegations under D.C. Code §§ 28- 

3904 (e), (f), and (f-1) are sufficient to satisfy the Civil Procedure Rule 8(a) pleading standard. 

a. The D.C. OAG’s Claims Pursuant to D.C. Code § 28-3904(e) Satisfy the 
Pleading Standard Set Forth in Superior Court Civil Procedure Rule 8(a) 

First, this Court finds that, if true, the D.C. OAG’s claims pursuant to D.C. Code § 28- 

3904(e) satisfy the pleading standard set forth in Rule 8(a). D.C. Code § 28-3904(e) prohibits 

misrepresentations as to material facts that have a tendency to mislead, whether or not any 

consumer is in fact misled, deceived, or damaged thereby. 

In its Complaint, the D.C. OAG alleges that Facebook violated subsection (e) by falsely 

representing to consumers that: 

(1) Facebook would protect the privacy of consumers’ personal information; 

(2) Facebook would require applications and third-party developers to respect the privacy of 
consumers’ personal information; and 

(3) The agreement between consumers and third-party applications would control how those 
applications used consumers’ data. 
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The D.C. OAG notes that Facebook’s 2013 Statement of Rights and Responsibilities provides, in 
pertinent part, that: “FACEBOOK IS NOT RESPONSIBLE FOR THE ACTIONS ... OF 
THIRD PARTIES.” Def.’s Mot. Ex. 3 at 7. (emphasis in original). At the same time, the 
Statement of Rights and Responsibilities stated, “[Facebook] require[s] applications to respect 
[users’] privacy, and [users’] agreement with the [third party] application will control how the 
[third party] application can use, store, and transfer that content and information.” Id. at 1. 

The D.C. OAG further alleges that Facebook allowed third parties to override consumers’ 
privacy settings and obtain information that consumers opted not to share. Facebook asserts that 
it disclosed this practice in its Data Use Policy by informing consumers that Facebook would 
“give [users’] information to the people and companies that help [Facebook] provide, 
understand, and improve the services [Facebook] offer[s].” Def.’s Mot. Ex. 8 at 16. 

This Court has determined that, pursuant to Rule 8(a), the D.C. OAG properly pleads a 
viable claim under § 28-3904(e) by stating that consumers were misled by Facebook’s Statement 
of Rights and Responsibilities, which allegedly failed to provide consumers with a clear 
explanation of how much responsibility Facebook undertook to protect consumers’ personal data 
from third parties. Further, D.C. OAG has asserted viable claims under § 28-3904(e) by alleging 
that Facebook’s disclosure—that it may share some users’ personal information with its partner 
companies—could lead a reasonable consumer to believe that the information obtained by third- 
parties from Facebook would be limited to the data users’ opted to share in their privacy settings. 
Accordingly, this Court finds that the D.C. OAG’s allegations are sufficient to set forth a prima 
facie case against Defendant Facebook under D.C. Code § 28-3904(e). 
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b. The D.C. OAG’s Claims Pursuant to D.C. Code § 28-3904(f) Satisfy 

the Pleading Standard Set Forth in Superior Court Civil Procedure Rule 8(a) 

Further, this Court finds that the D.C. OAG’s claims pursuant to D.C. Code § 28-3904(f) 
also satisfy the pleading standard set forth in Rule 8(a). D.C. Code § 28-3904(f) prohibits 
“failures to state material facts if such failures tend to mislead.” The District of Columbia Court 
of Appeals has held that D.C. Code § 28-3904(f) does not require plaintiffs to plead and prove a 
duty to disclose information. See Saucier v. Countrywide Home Loans, 64 A.3d 428, 444 (D.C. 
2013). Moreover, District of Columbia courts have found that the issue of materiality is generally 
an issue of fact for the jury. See id. at 442, 444-45. The Court must therefore solely determine 
whether the D.C. OAG’s allegations are legally sufficient to sustain a claim under D.C. Code § 
28-3904(f). 

In this case, the D.C. OAG alleges that Facebook failed to adequately warn its users that 
their personal data was improperly obtained, harvested, and used by third parties without the 
consumers’ knowledge or affirmative consent, in violation of Facebook’s policies. The D.C. 
OAG also alleges that Facebook failed to disclose to users that it allowed certain companies to 
override users’ privacy settings and access consumers’ personal data without their knowledge or 
consent. The D.C. OAG contends that several courts have found that fine print and obscurely 
placed disclosures, even if contained within a privacy policy, may be insufficient to give 
consumers reasonable notice that their personal information may be shared with third parties. 
See, e.g., Minnesota v. Fleet Mortg. Corp., 158 F. Supp. 2d 962 (D. Minn. 2001); In re Vizio, 
Inc., 238 F. Supp. 3d 1204 (C.D. Cal. 2017); Federal Trade Commission v. Brown & Williamson 
Tobacco Corp., 778 F.2d 35 (D.C. Cir. 1985). This Court finds that the D.C. OAG’s allegations 
could be viewed by a reasonable consumer as misleading omissions of material facts in violation 
of § 28-3904(f), and therefore are legally sufficient to meet the Rule 8(a) pleading standard. 
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Additionally, this Court rejects Facebook’s argument regarding D.C. Code § 28-3852 
with respect to the D.C. OAG’s CPPA claims. Facebook argues that the disclosure requirements 
set forth under D.C. Code § 28-3852 supersede the CPPA’s disclosure requirement because “it is 
a more specific statute governing disclosures to consumers after data breaches.” Def.’s Mot. 16. 
The Court notes that, while Facebook argues that D.C. Code § 28-3852 supersedes the CPPA, 
Facebook also admits that D.C. Code § 28-3852 does not apply in this context. Def.’s Mot. 16. 
Accordingly, this Court rejects Facebook’s arguments concerning D.C. Code § 28-3852. 

c. The D.C. OAG’s Claims Pursuant to D.C. Code § 28-3904(f-l) Satisfy the 
Pleading Standard Set Forth in Superior Court Civil Procedure Rule 8(a) 

Finally, this Court finds that D.C. OAG’s claims pursuant to D.C. Code § 28-3904(f-l) 
satisfy the Rule 8(a) pleading standard. D.C. Code § 28-3904(f-l) prohibits “the use of an 
innuendo or ambiguity as to a material fact that has a tendency to mislead.” The D.C. OAG 
specifically asserts that Facebook violated D.C. Code § 28-3904(f-l) because: 

(1) Facebook failed to explain to consumers how to control how information is shared 
with third-party applications, and how to change privacy settings with respect to 
applications; 

(2) Facebook represented to consumers that it would protect the privacy of consumers’ 
personal information; 

(3) Facebook represented to consumers that it requires applications and third-party 
developers to respect the privacy of consumers’ personal information; and 

(4) Facebook represented to consumers that consumers’ agreement with third-party 
applications will control how those applications use consumer data. 

The question of whether Facebook’s disclosures actually gave consumers unambiguous 
notice of its data-sharing practices, and their implications, is a question of fact for a jury. 
However, this Court holds that the allegations in the D.C. OAG’s Complaint, if true, could lead a 
reasonable consumer to find Facebook’s disclosures ambiguous and misleading, in violation of 
D.C. Code § 28-3904(f-l). Thus, in consideration of the Rule 8(a) pleading standard, this Court 
finds that the D.C. OAG’s allegations are sufficient. 
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3. This Case Will Not Be Staved Pending the Completion of the Multi- 

District Litigation Proceeding and/or the Federal Trade Commission 

Investigation 

The Court finds that a stay is not warranted at this stage of the case, regardless of the 
pending MDL proceeding in the Northern District of California or the pending FTC 
investigation. The determination as to whether to stay proceedings in the Superior Court of the 
District of Columbia pending resolution of a related action in District Court, or any other federal 
court, is within the sound discretion of the Court. See Thomas v. DA V Ass’n, 930 A.2d 997, 
1000-01 (D.C. 2007); Landis v. N. Am. Co., 299 U.S. 248, 254 (1936) (recognizing that “...the 
power to stay proceedings is incidental to the power inherent in every court to control the 
disposition of its docket with economy of time and effort for itself, for counsel, and for 
litigants.”). 

The District of Columbia Court of Appeals has specifically recognized that there is “no 
general requirement that the Superior Court defer to the District Court when related actions are 
pending in both courts, but it often will be prudent and efficient to do so, especially when the 
federal court was the first to acquire jurisdiction.” Thomas, 930 A.2d at 1000-01. In making this 
determination, the Court “must weigh competing interests and maintain an even balance.” 
Landis, 299 U.S. at 254-55 (citations omitted). However, the burden is on the moving party to 
“make out a clear case of hardship or inequity in being required to go forward[.]” Id. at 255. 

Here, the Court finds that staying proceedings in this case would not be prudent, as the 
local legal issues that are present in the instant case are distinct from the issues before the MDL 
Court. The Court recognizes that there is some overlap between the two matters, particularly as 
they involve the same defendant, Facebook, and both seek to adjudicate issues regarding 
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consumer data and privacy. Nevertheless, this Court finds that the law upon which the two cases 
are brought and the two sets of plaintiffs are distinct. 

The Court notes that the majority of plaintiffs in the MDL case are individual Facebook 
users who have brought claims in their personal capacity or “on behalf of a proposed nationwide 
class of people whose data had been obtained by Cambridge Analytica or other third parties.” In 
re Facebook, Inc., 354 F. Supp. 3d 1122, 1123 (N.D. Cal. 2019). In the instant case, the Plaintiff 
is the District of Columbia, a governmental entity seeking relief regarding Facebook’s alleged 
violations of District of Columbia laws. The Court recognizes that the claims brought in the 
MDL matter involve the consumer protection statutes of other states, such as Alabama, 
Colorado, and Illinois. However, the District of Columbia CPPA claims will not be addressed by 
the MDL, making it unlikely that the MDL will decide issues that are dispositive to the instant 
case. 

Moreover, staying proceedings in this case could unduly prejudice the D.C. OAG. The 

MDL has been pending before the Northern District of California for over a year, and the MDL 

court is presently litigating Defendant Facebook’s Motion to Dismiss the Amended Consolidated 

Complaint. This Court finds that the size and breadth of the MDL case make it uncertain whether 

and when any factual issues relevant to this proceeding will be resolved by the MDL Court. 

This general concern was also recognized by the MDL Court in regards to the Cook 

County State’s Attorney’s case, People of the State of Illinois, ex rel. Kimberly M. Foxx, State’s 

Attorney of Cook County, Illinois v. Facebook, Inc., et al., 2018 CH 3868. In its Order remanding 

the case, the MDL court specifically stated: 

When a case is folded into multidistrict litigation, it will almost inevitably be 
delayed. Its fate will be bound up in the fates of many others. The transferee 
judge may decide that certain claims should be prioritized or addressed first. 

The plaintiff may thus lose control over the direction of the lawsuit. And this 
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is a serious concern if the plaintiff is a government entity or official—the 
multidistrict litigation process would intrude on state or local sovereignty. 

In re Facebook, Inc., 354 F. Supp. 3d 1122, 1125 (N.D. Cal. 2019). While this Court recognizes 

that staying litigation is distinct from having this case enveloped by the MDL, the expressed 

concerns regarding efficiency and state sovereignty remain the same. The Court therefore 

concludes that it is more efficient to proceed with litigation in this matter, rather than to allow 

this case to remain in an indeterminate state for many months, if not years. 

Further, the Court similarly finds no basis to stay proceedings in this matter pending the 

conclusion of the FTC investigation. The Court notes that the FTC investigation seeks to 

determine whether Facebook violated the FTC’s 2012 Consent Order, whereas the focal point of 

litigation in this case is Facebook’s alleged violation of the CPPA. While there is some factual 

overlap between the FTC investigation and this case, the Court finds that this overlap is 

insufficient to merit staying litigation in this matter. 

Accordingly, upon consideration of the representations made, the entire record herein, 

and for good cause shown, it is this 3 / S’/" ** Jay of May 2019, hereby 

ORDERED, that Defendant Facebook, Inc.’s Opposed Motion to Dismiss, or in the 

Alternative, to Stay Proceedings is DENIED. 





FERN FLANAGAN SADDLER 
ASSOCIATE JUDGE 
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Ben Wiseman, Esquire 

Randolph T. Chen, Esquire 

Counsel for Plaintiff District of Columbia 

(via e-service) 

Christopher Leach, Esquire 
Joshua S. Lipshutz, Esquire 
Chantale Fiebig, Esquire 
Counsel for Defendant Facebook, Inc. 

(via e-service) 
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